c++syslogrsyslog

How to configure TLS programmatically with librelp for a relp server


I am creating a relp server using the librelp headers to receive messages from a client I am also creating. The documentation for this library is extremely sparse, and as such I cannot seem to configure TLS for my server. I have two approaches I have tried below, but I am not even sure that these are separate or complimentary. I have identified the functions below as being needed, however method 1 appears to supply all of the information that is passed by the functions in method 2.

Method 1: using TlsConfigCmd

Non-related code omitted.

main.cpp

<...>
relpSrv_t* pRelpSrv;
relpSrvSetEnableTLS2(pRelpSrv);
relpSrvSetTlsConfigCmd(pRelpSrv, GetFileChars("tls-cmd")); // GetFileChars reads file to char*
relpSrvSetAuthMode(pRelpSrv, (char*)"certvalid");
<...>
relpEngineRun(pRelpSrv);

tls-cmd

type="omrelp"
target="localhost" port="10000"
tls="on"
tls.caCert="ca-cert.pem"
tls.myCert="server-cert.pem"
tls.myPrivKey="server-key.pem"
tls.authMode="name"
tls.tlslib="openssl"
tks.tlscfgcmd="MinProtocol=TLSv1.2"

Method 2: SetCert/Setkey

Non-related code omitted.

<...>
relpSrv_t* pRelpSrv;
relpSrvSetOwnCert(pRelpSrv, GetFileChars("server-cert.pem");
relpSrvSetCACert(pRelpSrv, GetFileChars("ca-cert.pem");
relpSrvSetPrivKey(pRelpSrv, GetFileChars("server-key.pem");
relpSrvSetAuthMode(pRelpSrv, (char*)"certvalid");
<...>
relpEngineRun(pRelpSrv);

However, with either of these methods my client is still able to send messages, and the syslog receive callback (set with relpEngineSetSyslogRcv(pRelpEngine, &MyCallback);) is still called.

How can I configure my relp server to require TLS for messages?


Solution

  • I had two problems;

    1. TCP setting functions were called after relpEngineListenerConstructFinalize()
    2. The second argument relpSrvSetCACert(), relpSrvSetOwnCert() and relpSrvSetPrivKey() is the path to the respective key or cert, not the characters of the cert/key file

    TCP is now functioning. Both methods can be used to supply all required settings.